In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9614.
CVE-2026-20586
CVSS base score
8.8 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-787
Last modified
October 30, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
mediatek mt8910 firmware
mediatek mt2718 firmware
mediatek mt6768 firmware
mediatek mt6789 firmware
mediatek mt6769 firmware
mediatek mt6833 firmware
mediatek mt6855 firmware
mediatek mt6877 firmware
mediatek mt8186 firmware
mediatek mt8188 firmware
References
- www.mediatek.com Vendor Advisory